{"id":"CVE-2020-15143","aliases":["GHSA-p4pj-9g59-4ppv"],"url":"https://o3.security/vulnerability/CVE-2020-15143","summary":"Remote Code Execution in SyliusResourceBundle","details":"### Impact\n\nRequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.\n\nThe vulnerable versions include: `<=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3`.\n\n### Example\n\n```yaml\nfoo:\n    path: /foo/{id}\n    defaults:\n        _sylius:\n            repository:\n                method: findSome\n                arguments:\n                    entity: \"expr:service('repository').find($id)\"\n```\n\nIn this case, `$id` can be prepared in a way that calls other services. \n\nIf you visit `/foo/\"~service('doctrine').getManager().getConnection().executeQuery(\"DELETE * FROM TABLE\")~\"`, it will result in a following expression `expr:service('repository').find(\"\"~service('doctrine').getManager().getConnection().executeQuery(\"DELETE * FROM TABLE\")~\"\")`, which will execute a query on the currently connected database.\n\nTo find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.\n\n### Patches\n\nThis issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.\n\n### Workarounds\n\nThe fix requires adding `addslashes` in `ParametersParser::parseRequestValueExpression` to sanitize user input before evaluating it using the expression language.\n\n```php\n- return is_string($variable) ? sprintf('\"%s\"', $variable) : $variable;\n+ return is_string($variable) ? sprintf('\"%s\"', addslashes($variable)) : $variable;\n```\n\n### Acknowledgements\n\nThis security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Email us at [security@sylius.com](mailto:security@sylius.com)","published":"2020-08-20T01:17:11.993Z","modified":"2026-10-20T10:51:52.938103147Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.01914,"percentile":0.77993,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"sylius/resource-bundle","fixedVersion":"1.4.7"},{"ecosystem":"Packagist","name":"sylius/resource-bundle","fixedVersion":"1.5.2"},{"ecosystem":"Packagist","name":"sylius/resource-bundle","fixedVersion":"1.6.4"},{"ecosystem":"Packagist","name":"sylius/resource-bundle","fixedVersion":"1.3.14"}],"fix":{"url":"https://github.com/Sylius/SyliusResourceBundle/commit/73ed8b8bb083f36c30ad7c3cec336f65d6a80650","label":"Sylius/SyliusResourceBundle@73ed8b8"},"references":[{"type":"EVIDENCE","url":"https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15143"},{"type":"WEB","url":"https://github.com/Sylius/SyliusResourceBundle/commit/73ed8b8bb083f36c30ad7c3cec336f65d6a80650"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-15143.yaml"},{"type":"PACKAGE","url":"https://github.com/Sylius/SyliusResourceBundle"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-20T10:51:52.938103147Z"}}